# Fuzz Harness Gen

> Generate cargo-fuzz targets for Rust cryptographic code. User-triggered only and never auto-invoked by the audit flow. Produces crash and edge-case evidence for crypto-fp-check.

- Skill: `yue-zhou1/fuzz-harness-gen-2` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add yue-zhou1/fuzz-harness-gen-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yue-zhou1/fuzz-harness-gen-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Yue-Zhou1 (https://skillmd.com/u/yue-zhou1)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/yue-zhou1/fuzz-harness-gen-2

---


# fuzz-harness-gen

Generate `cargo-fuzz` targets for Rust cryptographic libraries and applications.

**This skill is user-triggered only.** It must never be auto-invoked by the
audit router or any other skill. Fuzz runs can be expensive (default timeout:
10 minutes per target via `FUZZ_TIME_LIMIT` and `FUZZ_MAX_ITERS`).

## When to Use

- User explicitly requests fuzz testing
- User invokes this skill by name
- A Phase 2 finding needs additional crash/DoS or logic-divergence evidence

## When NOT to Use

- Never auto-trigger from audit flow
- Never run without explicit user request
- Code is not Rust
- cargo-fuzz is not installed (detect and warn)

## Prerequisites

Before generating targets, verify cargo-fuzz is available:

```bash
cargo fuzz --version 2>/dev/null || echo "ERROR: cargo-fuzz not installed. Install with: cargo install cargo-fuzz"
```

If not installed, inform the user and stop.

## Core Target Categories

1. **Deserialization** — reject malformed inputs without panic
2. **Point decompression** — invalid encodings must fail safely
3. **Proof verification** — malformed proofs should be rejected, not panic
4. **Hash and transcript APIs** — odd-length/context inputs should fail closed
5. **Parser/state transitions** — random byte streams should not trigger UB or invariant breaks

## Budget and Fallback Controls

- Override fuzz run duration with `FUZZ_TIME_LIMIT` (default `600`)
- Override fuzz iteration cap with `FUZZ_MAX_ITERS` when deterministic bounds are needed
- Use optional `PROPTEST_CASES` for lightweight `proptest` checks when full fuzzing is unavailable

## Workflow

### Phase 1: Identify fuzz-worthy surfaces

- Read the target code and public APIs
- Prioritize parser, deserializer, verifier, and boundary-heavy functions
- Read `references/fuzz-checklist.md` for setup requirements

### Phase 2: Generate targets

- Read `references/target-patterns.md` for templates
- Generate `fuzz_target!` harnesses with minimal adapters
- Seed corpus when available and set `FUZZ_TIME_LIMIT` / `FUZZ_MAX_ITERS` bounds

### Phase 3: Execute and triage

- Run `cargo fuzz run <target>` with `FUZZ_TIME_LIMIT` / `FUZZ_MAX_ITERS` budget controls
- Classify crashes as panic/DoS vs logic/soundness implications
- Preserve crash artifacts for reproducible PoC evidence
- If fuzzing is unavailable, run bounded `proptest` checks (`PROPTEST_CASES`) and label evidence accordingly

## Output Contract

Produce fuzzing results that include:

- The generated target code
- The API/property surface being fuzzed
- Run budget and corpus strategy used
- PASS (no crash found in budget) or FAIL (crash/input found)
- If FAIL: minimized crashing input and reproduction command

## Reference Index

- [references/fuzz-checklist.md](references/fuzz-checklist.md)
- [references/target-patterns.md](references/target-patterns.md)